Lead generation lives or dies on documentation. When a buyer, a carrier, or a regulator asks what a consumer agreed to and when, the answer has to already be on file.
Consent is captured on our own forms, on pages we control — never inherited from an upstream source we cannot verify.
Each form names the categories of companies that may contact the consumer, links to the current marketing partner list, and states plainly that consent is not a condition of purchase.
Consumers are told which contact methods they are agreeing to — including automated dialing systems, prerecorded messages, and SMS where applicable — and are given a clear route to proceed without consenting where the product allows it.
When a disclosure changes, the version in force at the time of each submission stays attached to that record. We do not retroactively rewrite what a consumer saw.
A submission passes through the full pipeline before it is ever offered for delivery. Records that fail are logged with a reason code and are never billed.
Rate limiting by session and IP, a server-issued form token, and device fingerprint matching — so a submission has to come from a real session on a real page, not a script posting at the API.
Every submission is checked on a rolling 30-day window across five independent keys — phone, email, IP address, LeadiD token, and TrustedForm certificate — so a resubmission under a new name still gets caught.
Submission rate is tracked against a composite of IP, device fingerprint, and traffic source. Bursts that do not look like independent consumers are scored accordingly.
Email is checked for syntax, domain deliverability, disposable providers, and role-based addresses. Phone is validated as a reachable 10-digit US number. Names and free-text fields are screened for profanity and obvious junk.
Street addresses are checked for PO boxes and ZIP-to-state consistency, then compared against the IP's geolocation. Distance thresholds are tuned per state, with allowances for rural routing and mobile networks.
Tor exits, public proxies, datacenter ranges, and known residential-proxy providers are detected and weighted. Signals combine into a single score, and high-confidence fraud is blocked outright rather than forwarded.
Alongside the checks above, we record whether the session showed real interaction — mouse movement, clicks, scrolling, keystrokes, and field focus, blur, and paste events — and how long the consumer spent on the page. Hidden honeypot fields catch automated form fillers, and known bot user agents are rejected. A form completed in a fraction of the time a human needs is treated as suspect regardless of how clean the data looks.
Consumers can reach us directly about their information regardless of which of our properties they used, and we route the request to the right place rather than sending them in a circle.
Accepted leads, rejected submissions, and blocked attempts are all written to dated logs with their reason codes. That record is what lets us answer a buyer's question about a specific lead months after the fact.
Buyers auditing our process and partners checking their obligations are both welcome to ask. We would rather answer in detail up front than sort it out later.